1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  *	Copyright (c) 1990, 1991 UNIX System Laboratories, Inc.
24  *	Copyright (c) 1988 AT&T
25  *	  All Rights Reserved
26  *
27  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
28  * Use is subject to license terms.
29  */
30 #pragma ident	"%Z%%M%	%I%	%E% SMI"
31 
32 /* Get the x86 version of the relocation engine */
33 #define	DO_RELOC_LIBLD_X86
34 
35 #include	<string.h>
36 #include	<stdio.h>
37 #include	<sys/elf_386.h>
38 #include	<debug.h>
39 #include	<reloc.h>
40 #include	<i386/machdep_x86.h>
41 #include	"msg.h"
42 #include	"_libld.h"
43 
44 /* Forward declarations */
45 static Gotndx	*ld_find_gotndx(List *, Gotref, Ofl_desc *, Rel_desc *);
46 static Xword	ld_calc_got_offset(Rel_desc *, Ofl_desc *);
47 
48 
49 static Word
50 ld_init_rel(Rel_desc *reld, void *reloc)
51 {
52 	Rel *	rel = (Rel *)reloc;
53 
54 	/* LINTED */
55 	reld->rel_rtype = (Word)ELF_R_TYPE(rel->r_info, M_MACH);
56 	reld->rel_roffset = rel->r_offset;
57 	reld->rel_raddend = 0;
58 	reld->rel_typedata = 0;
59 
60 	return ((Word)ELF_R_SYM(rel->r_info));
61 }
62 
63 static void
64 ld_mach_eflags(Ehdr *ehdr, Ofl_desc *ofl)
65 {
66 	ofl->ofl_dehdr->e_flags |= ehdr->e_flags;
67 }
68 
69 static void
70 ld_mach_make_dynamic(Ofl_desc *ofl, size_t *cnt)
71 {
72 	if (!(ofl->ofl_flags & FLG_OF_RELOBJ)) {
73 		/*
74 		 * Create this entry if we are going to create a PLT table.
75 		 */
76 		if (ofl->ofl_pltcnt)
77 			(*cnt)++;		/* DT_PLTGOT */
78 	}
79 }
80 
81 static void
82 ld_mach_update_odynamic(Ofl_desc *ofl, Dyn **dyn)
83 {
84 	if (((ofl->ofl_flags & FLG_OF_RELOBJ) == 0) && ofl->ofl_pltcnt) {
85 		(*dyn)->d_tag = DT_PLTGOT;
86 		if (ofl->ofl_osgot)
87 			(*dyn)->d_un.d_ptr = ofl->ofl_osgot->os_shdr->sh_addr;
88 		else
89 			(*dyn)->d_un.d_ptr = 0;
90 		(*dyn)++;
91 	}
92 }
93 
94 static Xword
95 ld_calc_plt_addr(Sym_desc *sdp, Ofl_desc *ofl)
96 {
97 	Xword	value;
98 
99 	value = (Xword)(ofl->ofl_osplt->os_shdr->sh_addr) +
100 	    M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) * M_PLT_ENTSIZE);
101 	return (value);
102 }
103 
104 /*
105  *  Build a single plt entry - code is:
106  *	if (building a.out)
107  *		JMP	*got_off
108  *	else
109  *		JMP	*got_off@GOT(%ebx)
110  *	PUSHL	&rel_off
111  *	JMP	-n(%pc)		# -n is pcrel offset to first plt entry
112  *
113  *	The got_off@GOT entry gets filled with the address of the PUSHL,
114  *	so the first pass through the plt jumps back here, jumping
115  *	in turn to the first plt entry, which jumps to the dynamic
116  *	linker.	 The dynamic linker then patches the GOT, rerouting
117  *	future plt calls to the proper destination.
118  */
119 static void
120 plt_entry(Ofl_desc * ofl, Word rel_off, Sym_desc * sdp)
121 {
122 	uchar_t		*pltent, *gotent;
123 	Sword		plt_off;
124 	Word		got_off;
125 	int		bswap = (ofl->ofl_flags1 & FLG_OF1_ENCDIFF) != 0;
126 
127 	got_off = sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
128 	plt_off = M_PLT_RESERVSZ + ((sdp->sd_aux->sa_PLTndx - 1) *
129 	    M_PLT_ENTSIZE);
130 	pltent = (uchar_t *)(ofl->ofl_osplt->os_outdata->d_buf) + plt_off;
131 	gotent = (uchar_t *)(ofl->ofl_osgot->os_outdata->d_buf) + got_off;
132 
133 	/*
134 	 * Fill in the got entry with the address of the next instruction.
135 	 */
136 	/* LINTED */
137 	*(Word *)gotent = ofl->ofl_osplt->os_shdr->sh_addr + plt_off +
138 	    M_PLT_INSSIZE;
139 	if (bswap)
140 		/* LINTED */
141 		*(Word *)gotent = ld_bswap_Word(*(Word *)gotent);
142 
143 	if (!(ofl->ofl_flags & FLG_OF_SHAROBJ)) {
144 		pltent[0] = M_SPECIAL_INST;
145 		pltent[1] = M_JMP_DISP_IND;
146 		pltent += 2;
147 		/* LINTED */
148 		*(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->sh_addr +
149 		    got_off);
150 	} else {
151 		pltent[0] = M_SPECIAL_INST;
152 		pltent[1] = M_JMP_REG_DISP_IND;
153 		pltent += 2;
154 		/* LINTED */
155 		*(Word *)pltent = (Word)got_off;
156 	}
157 	if (bswap)
158 		/* LINTED */
159 		*(Word *)pltent = ld_bswap_Word(*(Word *)pltent);
160 	pltent += 4;
161 
162 	pltent[0] = M_INST_PUSHL;
163 	pltent++;
164 	/* LINTED */
165 	*(Word *)pltent = (Word)rel_off;
166 	if (bswap)
167 		/* LINTED */
168 		*(Word *)pltent = ld_bswap_Word(*(Word *)pltent);
169 	pltent += 4;
170 
171 	plt_off = -(plt_off + 16);	/* JMP, PUSHL, JMP take 16 bytes */
172 	pltent[0] = M_INST_JMP;
173 	pltent++;
174 	/* LINTED */
175 	*(Word *)pltent = (Word)plt_off;
176 	if (bswap)
177 		/* LINTED */
178 		*(Word *)pltent = ld_bswap_Word(*(Word *)pltent);
179 }
180 
181 static uintptr_t
182 ld_perform_outreloc(Rel_desc * orsp, Ofl_desc * ofl)
183 {
184 	Os_desc *	relosp, * osp = 0;
185 	Word		ndx, roffset, value;
186 	Rel		rea;
187 	char		*relbits;
188 	Sym_desc *	sdp, * psym = (Sym_desc *)0;
189 	int		sectmoved = 0;
190 
191 	sdp = orsp->rel_sym;
192 
193 	/*
194 	 * If the section this relocation is against has been discarded
195 	 * (-zignore), then also discard (skip) the relocation itself.
196 	 */
197 	if (orsp->rel_isdesc && ((orsp->rel_flags &
198 	    (FLG_REL_GOT | FLG_REL_BSS | FLG_REL_PLT | FLG_REL_NOINFO)) == 0) &&
199 	    (orsp->rel_isdesc->is_flags & FLG_IS_DISCARD)) {
200 		DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml, M_MACH, orsp));
201 		return (1);
202 	}
203 
204 	/*
205 	 * If this is a relocation against a move table, or expanded move
206 	 * table, adjust the relocation entries.
207 	 */
208 	if (orsp->rel_move)
209 		ld_adj_movereloc(ofl, orsp);
210 
211 	/*
212 	 * If this is a relocation against a section using a partial initialized
213 	 * symbol, adjust the embedded symbol info.
214 	 *
215 	 * The second argument of the am_I_partial() is the value stored at the
216 	 * target address relocation is going to be applied.
217 	 */
218 	if (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION) {
219 		if (ofl->ofl_parsym.head &&
220 		    (sdp->sd_isc->is_flags & FLG_IS_RELUPD) &&
221 		    /* LINTED */
222 		    (psym = ld_am_I_partial(orsp, *(Xword *)
223 		    ((uchar_t *)(orsp->rel_isdesc->is_indata->d_buf) +
224 		    orsp->rel_roffset)))) {
225 			DBG_CALL(Dbg_move_outsctadj(ofl->ofl_lml, psym));
226 			sectmoved = 1;
227 		}
228 	}
229 
230 	value = sdp->sd_sym->st_value;
231 
232 	if (orsp->rel_flags & FLG_REL_GOT) {
233 		osp = ofl->ofl_osgot;
234 		roffset = (Word)ld_calc_got_offset(orsp, ofl);
235 
236 	} else if (orsp->rel_flags & FLG_REL_PLT) {
237 		/*
238 		 * Note that relocations for PLT's actually
239 		 * cause a relocation againt the GOT.
240 		 */
241 		osp = ofl->ofl_osplt;
242 		roffset = (Word) (ofl->ofl_osgot->os_shdr->sh_addr) +
243 		    sdp->sd_aux->sa_PLTGOTndx * M_GOT_ENTSIZE;
244 
245 		plt_entry(ofl, osp->os_relosdesc->os_szoutrels, sdp);
246 
247 	} else if (orsp->rel_flags & FLG_REL_BSS) {
248 		/*
249 		 * This must be a R_386_COPY.  For these set the roffset to
250 		 * point to the new symbols location.
251 		 */
252 		osp = ofl->ofl_isbss->is_osdesc;
253 		roffset = (Word)value;
254 	} else {
255 		osp = orsp->rel_osdesc;
256 
257 		/*
258 		 * Calculate virtual offset of reference point; equals offset
259 		 * into section + vaddr of section for loadable sections, or
260 		 * offset plus section displacement for nonloadable sections.
261 		 */
262 		roffset = orsp->rel_roffset +
263 		    (Off)_elf_getxoff(orsp->rel_isdesc->is_indata);
264 		if (!(ofl->ofl_flags & FLG_OF_RELOBJ))
265 			roffset += orsp->rel_isdesc->is_osdesc->
266 			    os_shdr->sh_addr;
267 	}
268 
269 	if ((osp == 0) || ((relosp = osp->os_relosdesc) == 0))
270 		relosp = ofl->ofl_osrel;
271 
272 	/*
273 	 * Assign the symbols index for the output relocation.  If the
274 	 * relocation refers to a SECTION symbol then it's index is based upon
275 	 * the output sections symbols index.  Otherwise the index can be
276 	 * derived from the symbols index itself.
277 	 */
278 	if (orsp->rel_rtype == R_386_RELATIVE)
279 		ndx = STN_UNDEF;
280 	else if ((orsp->rel_flags & FLG_REL_SCNNDX) ||
281 	    (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION)) {
282 		if (sectmoved == 0) {
283 			/*
284 			 * Check for a null input section. This can
285 			 * occur if this relocation references a symbol
286 			 * generated by sym_add_sym().
287 			 */
288 			if ((sdp->sd_isc != 0) &&
289 			    (sdp->sd_isc->is_osdesc != 0))
290 				ndx = sdp->sd_isc->is_osdesc->os_scnsymndx;
291 			else
292 				ndx = sdp->sd_shndx;
293 		} else
294 			ndx = ofl->ofl_sunwdata1ndx;
295 	} else
296 		ndx = sdp->sd_symndx;
297 
298 	/*
299 	 * If we have a replacement value for the relocation
300 	 * target, put it in place now.
301 	 */
302 	if (orsp->rel_flags & FLG_REL_NADDEND) {
303 		Xword	addend = orsp->rel_raddend;
304 		uchar_t	*addr;
305 
306 		/*
307 		 * Get the address of the data item we need to modify.
308 		 */
309 		addr = (uchar_t *)((uintptr_t)orsp->rel_roffset +
310 		    (uintptr_t)_elf_getxoff(orsp->rel_isdesc->is_indata));
311 		addr += (uintptr_t)orsp->rel_osdesc->os_outdata->d_buf;
312 		if (ld_reloc_targval_set(ofl, orsp, addr, addend) == 0)
313 			return (S_ERROR);
314 	}
315 
316 	relbits = (char *)relosp->os_outdata->d_buf;
317 
318 	rea.r_info = ELF_R_INFO(ndx, orsp->rel_rtype);
319 	rea.r_offset = roffset;
320 	DBG_CALL(Dbg_reloc_out(ofl, ELF_DBG_LD, SHT_REL, &rea, relosp->os_name,
321 	    orsp->rel_sname));
322 
323 	/*
324 	 * Assert we haven't walked off the end of our relocation table.
325 	 */
326 	assert(relosp->os_szoutrels <= relosp->os_shdr->sh_size);
327 
328 	(void) memcpy((relbits + relosp->os_szoutrels),
329 	    (char *)&rea, sizeof (Rel));
330 	relosp->os_szoutrels += sizeof (Rel);
331 
332 	/*
333 	 * Determine if this relocation is against a non-writable, allocatable
334 	 * section.  If so we may need to provide a text relocation diagnostic.
335 	 * Note that relocations against the .plt (R_386_JMP_SLOT) actually
336 	 * result in modifications to the .got.
337 	 */
338 	if (orsp->rel_rtype == R_386_JMP_SLOT)
339 		osp = ofl->ofl_osgot;
340 
341 	ld_reloc_remain_entry(orsp, osp, ofl);
342 	return (1);
343 }
344 
345 /*
346  * i386 Instructions for TLS processing
347  */
348 static uchar_t tlsinstr_gd_ie[] = {
349 	/*
350 	 * 0x00	movl %gs:0x0, %eax
351 	 */
352 	0x65, 0xa1, 0x00, 0x00, 0x00, 0x00,
353 	/*
354 	 * 0x06	addl x(%eax), %eax
355 	 * 0x0c ...
356 	 */
357 	0x03, 0x80, 0x00, 0x00, 0x00, 0x00
358 };
359 
360 static uchar_t tlsinstr_gd_le[] = {
361 	/*
362 	 * 0x00 movl %gs:0x0, %eax
363 	 */
364 	0x65, 0xa1, 0x00, 0x00, 0x00, 0x00,
365 	/*
366 	 * 0x06 addl $0x0, %eax
367 	 */
368 	0x05, 0x00, 0x00, 0x00, 0x00,
369 	/*
370 	 * 0x0b nop
371 	 * 0x0c
372 	 */
373 	0x90
374 };
375 
376 static uchar_t tlsinstr_gd_ie_movgs[] = {
377 	/*
378 	 *	movl %gs:0x0,%eax
379 	 */
380 	0x65, 0xa1, 0x00, 0x00, 0x00, 00
381 };
382 
383 #define	TLS_GD_IE_MOV	0x8b	/* movl opcode */
384 #define	TLS_GD_IE_POP	0x58	/* popl + reg */
385 
386 #define	TLS_GD_LE_MOVL	0xb8	/* movl + reg */
387 
388 #define	TLS_NOP		0x90	/* NOP instruction */
389 
390 #define	MODRM_MSK_MOD	0xc0
391 #define	MODRM_MSK_RO	0x38
392 #define	MODRM_MSK_RM	0x07
393 
394 #define	SIB_MSK_SS	0xc0
395 #define	SIB_MSK_IND	0x38
396 #define	SIB_MSK_BS	0x07
397 
398 static Fixupret
399 tls_fixups(Ofl_desc *ofl, Rel_desc *arsp)
400 {
401 	Sym_desc	*sdp = arsp->rel_sym;
402 	Word		rtype = arsp->rel_rtype;
403 	uchar_t		*offset, r1, r2;
404 
405 	offset = (uchar_t *)((uintptr_t)arsp->rel_roffset +
406 	    (uintptr_t)_elf_getxoff(arsp->rel_isdesc->is_indata) +
407 	    (uintptr_t)arsp->rel_osdesc->os_outdata->d_buf);
408 
409 	if (sdp->sd_ref == REF_DYN_NEED) {
410 		/*
411 		 * IE reference model
412 		 */
413 		switch (rtype) {
414 		case R_386_TLS_GD:
415 			/*
416 			 * Transition:
417 			 *	0x0 leal x@tlsgd(,r1,1), %eax
418 			 *	0x7 call ___tls_get_addr
419 			 *	0xc
420 			 * To:
421 			 *	0x0 movl %gs:0, %eax
422 			 *	0x6 addl x@gotntpoff(r1), %eax
423 			 */
424 			DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
425 			    R_386_TLS_GOTIE, arsp));
426 			arsp->rel_rtype = R_386_TLS_GOTIE;
427 			arsp->rel_roffset += 5;
428 
429 			/*
430 			 * Adjust 'offset' to beginning of instruction
431 			 * sequence.
432 			 */
433 			offset -= 3;
434 			r1 = (offset[2] & SIB_MSK_IND) >> 3;
435 			(void) memcpy(offset, tlsinstr_gd_ie,
436 			    sizeof (tlsinstr_gd_ie));
437 
438 			/*
439 			 * set register %r1 into the addl
440 			 * instruction.
441 			 */
442 			offset[0x7] |= r1;
443 			return (FIX_RELOC);
444 
445 		case R_386_TLS_GD_PLT:
446 			/*
447 			 * Fixup done via the TLS_GD relocation
448 			 */
449 			DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
450 			    R_386_NONE, arsp));
451 			return (FIX_DONE);
452 		}
453 	}
454 
455 	/*
456 	 * LE reference model
457 	 */
458 	switch (rtype) {
459 	case R_386_TLS_GD:
460 		/*
461 		 * Transition:
462 		 *	0x0 leal x@tlsgd(,r1,1), %eax
463 		 *	0x7 call ___tls_get_addr
464 		 *	0xc
465 		 * To:
466 		 *	0x0 movl %gs:0, %eax
467 		 *	0x6 addl $x@ntpoff, %eax
468 		 *	0xb nop
469 		 *	0xc
470 		 */
471 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
472 		    R_386_TLS_LE, arsp));
473 
474 		arsp->rel_rtype = R_386_TLS_LE;
475 		arsp->rel_roffset += 4;
476 
477 		/*
478 		 * Adjust 'offset' to beginning of instruction
479 		 * sequence.
480 		 */
481 		offset -= 3;
482 		(void) memcpy(offset, tlsinstr_gd_le,
483 		    sizeof (tlsinstr_gd_le));
484 		return (FIX_RELOC);
485 
486 	case R_386_TLS_GD_PLT:
487 	case R_386_PLT32:
488 		/*
489 		 * Fixup done via the TLS_GD relocation
490 		 */
491 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
492 		    R_386_NONE, arsp));
493 		return (FIX_DONE);
494 
495 	case R_386_TLS_LDM_PLT:
496 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
497 		    R_386_NONE, arsp));
498 
499 		/*
500 		 * Transition:
501 		 *	call __tls_get_addr()
502 		 * to:
503 		 *	nop
504 		 *	nop
505 		 *	nop
506 		 *	nop
507 		 *	nop
508 		 */
509 		*(offset - 1) = TLS_NOP;
510 		*(offset) = TLS_NOP;
511 		*(offset + 1) = TLS_NOP;
512 		*(offset + 2) = TLS_NOP;
513 		*(offset + 3) = TLS_NOP;
514 		return (FIX_DONE);
515 
516 	case R_386_TLS_LDM:
517 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
518 		    R_386_NONE, arsp));
519 
520 		/*
521 		 * Transition:
522 		 *
523 		 *  0x00 leal x1@tlsldm(%ebx), %eax
524 		 *  0x06 call ___tls_get_addr
525 		 *
526 		 * to:
527 		 *
528 		 *  0x00 movl %gs:0, %eax
529 		 */
530 		(void) memcpy(offset - 2, tlsinstr_gd_ie_movgs,
531 		    sizeof (tlsinstr_gd_ie_movgs));
532 		return (FIX_DONE);
533 
534 	case R_386_TLS_LDO_32:
535 		/*
536 		 *  Instructions:
537 		 *
538 		 *  0x10 leal x1@dtpoff(%eax), %edx	R_386_TLS_LDO_32
539 		 *		to
540 		 *  0x10 leal x1@ntpoff(%eax), %edx	R_386_TLS_LE
541 		 *
542 		 */
543 		offset -= 2;
544 
545 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
546 		    R_386_TLS_LE, arsp));
547 		arsp->rel_rtype = R_386_TLS_LE;
548 		return (FIX_RELOC);
549 
550 	case R_386_TLS_GOTIE:
551 		/*
552 		 * These transitions are a little different than the
553 		 * others, in that we could have multiple instructions
554 		 * pointed to by a single relocation.  Depending upon the
555 		 * instruction, we perform a different code transition.
556 		 *
557 		 * Here's the known transitions:
558 		 *
559 		 *  1) movl foo@gotntpoff(%reg1), %reg2
560 		 *	0x8b, 0x80 | (reg2 << 3) | reg1, foo@gotntpoff
561 		 *
562 		 *  2) addl foo@gotntpoff(%reg1), %reg2
563 		 *	0x03, 0x80 | (reg2 << 3) | reg1, foo@gotntpoff
564 		 *
565 		 *  Transitions IE -> LE
566 		 *
567 		 *  1) movl $foo@ntpoff, %reg2
568 		 *	0xc7, 0xc0 | reg2, foo@ntpoff
569 		 *
570 		 *  2) addl $foo@ntpoff, %reg2
571 		 *	0x81, 0xc0 | reg2, foo@ntpoff
572 		 *
573 		 * Note: reg1 != 4 (%esp)
574 		 */
575 		DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
576 		    R_386_TLS_LE, arsp));
577 		arsp->rel_rtype = R_386_TLS_LE;
578 
579 		offset -= 2;
580 		r2 = (offset[1] & MODRM_MSK_RO) >> 3;
581 		if (offset[0] == 0x8b) {
582 			/* case 1 above */
583 			offset[0] = 0xc7;	/* movl */
584 			offset[1] = 0xc0 | r2;
585 			return (FIX_RELOC);
586 		}
587 
588 		if (offset[0] == 0x03) {
589 			/* case 2 above */
590 			assert(offset[0] == 0x03);
591 			offset[0] = 0x81;	/* addl */
592 			offset[1] = 0xc0 | r2;
593 			return (FIX_RELOC);
594 		}
595 
596 		/*
597 		 * Unexpected instruction sequence - fatal error.
598 		 */
599 		{
600 			Conv_inv_buf_t	inv_buf;
601 
602 			eprintf(ofl->ofl_lml, ERR_FATAL,
603 			    MSG_INTL(MSG_REL_BADTLSINS),
604 			    conv_reloc_386_type(arsp->rel_rtype, 0, &inv_buf),
605 			    arsp->rel_isdesc->is_file->ifl_name,
606 			    demangle(arsp->rel_sname),
607 			    arsp->rel_isdesc->is_name,
608 			    EC_OFF(arsp->rel_roffset));
609 		}
610 		return (FIX_ERROR);
611 
612 	case R_386_TLS_IE:
613 		/*
614 		 * These transitions are a little different than the
615 		 * others, in that we could have multiple instructions
616 		 * pointed to by a single relocation.  Depending upon the
617 		 * instruction, we perform a different code transition.
618 		 *
619 		 * Here's the known transitions:
620 		 *  1) movl foo@indntpoff, %eax
621 		 *	0xa1, foo@indntpoff
622 		 *
623 		 *  2) movl foo@indntpoff, %eax
624 		 *	0x8b, 0x05 | (reg << 3), foo@gotntpoff
625 		 *
626 		 *  3) addl foo@indntpoff, %eax
627 		 *	0x03, 0x05 | (reg << 3), foo@gotntpoff
628 		 *
629 		 *  Transitions IE -> LE
630 		 *
631 		 *  1) movl $foo@ntpoff, %eax
632 		 *	0xb8, foo@ntpoff
633 		 *
634 		 *  2) movl $foo@ntpoff, %reg
635 		 *	0xc7, 0xc0 | reg, foo@ntpoff
636 		 *
637 		 *  3) addl $foo@ntpoff, %reg
638 		 *	0x81, 0xc0 | reg, foo@ntpoff
639 		 */
640 		arsp->rel_rtype = R_386_TLS_LE;
641 		offset--;
642 		if (offset[0] == 0xa1) {
643 			/* case 1 above */
644 			offset[0] = 0xb8;	/*  movl */
645 			return (FIX_RELOC);
646 		}
647 
648 		offset--;
649 		if (offset[0] == 0x8b) {
650 			/* case 2 above */
651 			r2 = (offset[1] & MODRM_MSK_RO) >> 3;
652 			offset[0] = 0xc7;	/* movl */
653 			offset[1] = 0xc0 | r2;
654 			return (FIX_RELOC);
655 		}
656 		if (offset[0] == 0x03) {
657 			/* case 3 above */
658 			r2 = (offset[1] & MODRM_MSK_RO) >> 3;
659 			offset[0] = 0x81;	/* addl */
660 			offset[1] = 0xc0 | r2;
661 			return (FIX_RELOC);
662 		}
663 		/*
664 		 * Unexpected instruction sequence - fatal error.
665 		 */
666 		{
667 			Conv_inv_buf_t	inv_buf;
668 
669 			eprintf(ofl->ofl_lml, ERR_FATAL,
670 			    MSG_INTL(MSG_REL_BADTLSINS),
671 			    conv_reloc_386_type(arsp->rel_rtype, 0, &inv_buf),
672 			    arsp->rel_isdesc->is_file->ifl_name,
673 			    demangle(arsp->rel_sname),
674 			    arsp->rel_isdesc->is_name,
675 			    EC_OFF(arsp->rel_roffset));
676 		}
677 		return (FIX_ERROR);
678 	}
679 	return (FIX_RELOC);
680 }
681 
682 static uintptr_t
683 ld_do_activerelocs(Ofl_desc *ofl)
684 {
685 	Rel_desc	*arsp;
686 	Rel_cache	*rcp;
687 	Listnode	*lnp;
688 	uintptr_t	return_code = 1;
689 	ofl_flag_t	flags = ofl->ofl_flags;
690 
691 	if (ofl->ofl_actrels.head)
692 		DBG_CALL(Dbg_reloc_doact_title(ofl->ofl_lml));
693 
694 	/*
695 	 * Process active relocations.
696 	 */
697 	for (LIST_TRAVERSE(&ofl->ofl_actrels, lnp, rcp)) {
698 		/* LINTED */
699 		for (arsp = (Rel_desc *)(rcp + 1);
700 		    arsp < rcp->rc_free; arsp++) {
701 			uchar_t		*addr;
702 			Xword 		value;
703 			Sym_desc	*sdp;
704 			const char	*ifl_name;
705 			Xword		refaddr;
706 			int		moved = 0;
707 			Gotref		gref;
708 
709 			/*
710 			 * If the section this relocation is against has been
711 			 * discarded (-zignore), then discard (skip) the
712 			 * relocation itself.
713 			 */
714 			if ((arsp->rel_isdesc->is_flags & FLG_IS_DISCARD) &&
715 			    ((arsp->rel_flags &
716 			    (FLG_REL_GOT | FLG_REL_BSS |
717 			    FLG_REL_PLT | FLG_REL_NOINFO)) == 0)) {
718 				DBG_CALL(Dbg_reloc_discard(ofl->ofl_lml,
719 				    M_MACH, arsp));
720 				continue;
721 			}
722 
723 			/*
724 			 * We deteremine what the 'got reference'
725 			 * model (if required) is at this point.  This
726 			 * needs to be done before tls_fixup() since
727 			 * it may 'transition' our instructions.
728 			 *
729 			 * The got table entries have already been assigned,
730 			 * and we bind to those initial entries.
731 			 */
732 			if (arsp->rel_flags & FLG_REL_DTLS)
733 				gref = GOT_REF_TLSGD;
734 			else if (arsp->rel_flags & FLG_REL_MTLS)
735 				gref = GOT_REF_TLSLD;
736 			else if (arsp->rel_flags & FLG_REL_STLS)
737 				gref = GOT_REF_TLSIE;
738 			else
739 				gref = GOT_REF_GENERIC;
740 
741 			/*
742 			 * Perform any required TLS fixups.
743 			 */
744 			if (arsp->rel_flags & FLG_REL_TLSFIX) {
745 				Fixupret	ret;
746 
747 				if ((ret = tls_fixups(ofl, arsp)) == FIX_ERROR)
748 					return (S_ERROR);
749 				if (ret == FIX_DONE)
750 					continue;
751 			}
752 
753 			/*
754 			 * If this is a relocation against a move table, or
755 			 * expanded move table, adjust the relocation entries.
756 			 */
757 			if (arsp->rel_move)
758 				ld_adj_movereloc(ofl, arsp);
759 
760 			sdp = arsp->rel_sym;
761 			refaddr = arsp->rel_roffset +
762 			    (Off)_elf_getxoff(arsp->rel_isdesc->is_indata);
763 
764 			if (arsp->rel_flags & FLG_REL_CLVAL)
765 				value = 0;
766 			else if (ELF_ST_TYPE(sdp->sd_sym->st_info) ==
767 			    STT_SECTION) {
768 				Sym_desc	*sym;
769 
770 				/*
771 				 * The value for a symbol pointing to a SECTION
772 				 * is based off of that sections position.
773 				 *
774 				 * The second argument of the ld_am_I_partial()
775 				 * is the value stored at the target address
776 				 * relocation is going to be applied.
777 				 */
778 				if ((sdp->sd_isc->is_flags & FLG_IS_RELUPD) &&
779 				    /* LINTED */
780 				    (sym = ld_am_I_partial(arsp, *(Xword *)
781 				    ((uchar_t *)
782 				    arsp->rel_isdesc->is_indata->d_buf +
783 				    arsp->rel_roffset)))) {
784 					/*
785 					 * If the symbol is moved,
786 					 * adjust the value
787 					 */
788 					value = sym->sd_sym->st_value;
789 					moved = 1;
790 				} else {
791 					value = _elf_getxoff(
792 					    sdp->sd_isc->is_indata);
793 					if (sdp->sd_isc->is_shdr->sh_flags &
794 					    SHF_ALLOC)
795 						value += sdp->sd_isc->
796 						    is_osdesc->os_shdr->sh_addr;
797 				}
798 				if (sdp->sd_isc->is_shdr->sh_flags & SHF_TLS)
799 					value -= ofl->ofl_tlsphdr->p_vaddr;
800 
801 			} else if (IS_SIZE(arsp->rel_rtype)) {
802 				/*
803 				 * Size relocations require the symbols size.
804 				 */
805 				value = sdp->sd_sym->st_size;
806 			} else {
807 				/*
808 				 * Else the value is the symbols value.
809 				 */
810 				value = sdp->sd_sym->st_value;
811 			}
812 
813 			/*
814 			 * Relocation against the GLOBAL_OFFSET_TABLE.
815 			 */
816 			if (arsp->rel_flags & FLG_REL_GOT)
817 				arsp->rel_osdesc = ofl->ofl_osgot;
818 
819 			/*
820 			 * If loadable and not producing a relocatable object
821 			 * add the sections virtual address to the reference
822 			 * address.
823 			 */
824 			if ((arsp->rel_flags & FLG_REL_LOAD) &&
825 			    ((flags & FLG_OF_RELOBJ) == 0))
826 				refaddr += arsp->rel_isdesc->is_osdesc->
827 				    os_shdr->sh_addr;
828 
829 			/*
830 			 * If this entry has a PLT assigned to it, it's
831 			 * value is actually the address of the PLT (and
832 			 * not the address of the function).
833 			 */
834 			if (IS_PLT(arsp->rel_rtype)) {
835 				if (sdp->sd_aux && sdp->sd_aux->sa_PLTndx)
836 					value = ld_calc_plt_addr(sdp, ofl);
837 			}
838 
839 			/*
840 			 * Determine whether the value needs further adjustment.
841 			 * Filter through the attributes of the relocation to
842 			 * determine what adjustment is required.  Note, many
843 			 * of the following cases are only applicable when a
844 			 * .got is present.  As a .got is not generated when a
845 			 * relocatable object is being built, any adjustments
846 			 * that require a .got need to be skipped.
847 			 */
848 			if ((arsp->rel_flags & FLG_REL_GOT) &&
849 			    ((flags & FLG_OF_RELOBJ) == 0)) {
850 				Xword		R1addr;
851 				uintptr_t	R2addr;
852 				Word		gotndx;
853 				Gotndx		*gnp;
854 
855 				/*
856 				 * Perform relocation against GOT table.  Since
857 				 * this doesn't fit exactly into a relocation
858 				 * we place the appropriate byte in the GOT
859 				 * directly
860 				 *
861 				 * Calculate offset into GOT at which to apply
862 				 * the relocation.
863 				 */
864 				gnp = ld_find_gotndx(&(sdp->sd_GOTndxs), gref,
865 				    ofl, 0);
866 				assert(gnp);
867 
868 				if (arsp->rel_rtype == R_386_TLS_DTPOFF32)
869 					gotndx = gnp->gn_gotndx + 1;
870 				else
871 					gotndx = gnp->gn_gotndx;
872 
873 				R1addr = (Xword)(gotndx * M_GOT_ENTSIZE);
874 
875 				/*
876 				 * Add the GOTs data's offset.
877 				 */
878 				R2addr = R1addr + (uintptr_t)
879 				    arsp->rel_osdesc->os_outdata->d_buf;
880 
881 				DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml,
882 				    ELF_DBG_LD, M_MACH, SHT_REL,
883 				    arsp->rel_rtype, R1addr, value,
884 				    arsp->rel_sname, arsp->rel_osdesc));
885 
886 				/*
887 				 * And do it.
888 				 */
889 				if (ofl->ofl_flags1 & FLG_OF1_ENCDIFF)
890 					*(Xword *)R2addr =
891 					    ld_bswap_Xword(value);
892 				else
893 					*(Xword *)R2addr = value;
894 				continue;
895 
896 			} else if (IS_GOT_BASED(arsp->rel_rtype) &&
897 			    ((flags & FLG_OF_RELOBJ) == 0)) {
898 				value -= ofl->ofl_osgot->os_shdr->sh_addr;
899 
900 			} else if (IS_GOT_PC(arsp->rel_rtype) &&
901 			    ((flags & FLG_OF_RELOBJ) == 0)) {
902 				value =
903 				    (Xword)(ofl->ofl_osgot->os_shdr->sh_addr) -
904 				    refaddr;
905 
906 			} else if ((IS_PC_RELATIVE(arsp->rel_rtype)) &&
907 			    (((flags & FLG_OF_RELOBJ) == 0) ||
908 			    (arsp->rel_osdesc == sdp->sd_isc->is_osdesc))) {
909 				value -= refaddr;
910 
911 			} else if (IS_TLS_INS(arsp->rel_rtype) &&
912 			    IS_GOT_RELATIVE(arsp->rel_rtype) &&
913 			    ((flags & FLG_OF_RELOBJ) == 0)) {
914 				Gotndx	*gnp;
915 
916 				gnp = ld_find_gotndx(&(sdp->sd_GOTndxs), gref,
917 				    ofl, 0);
918 				assert(gnp);
919 				value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
920 				if (arsp->rel_rtype == R_386_TLS_IE) {
921 					value +=
922 					    ofl->ofl_osgot->os_shdr->sh_addr;
923 				}
924 
925 			} else if (IS_GOT_RELATIVE(arsp->rel_rtype) &&
926 			    ((flags & FLG_OF_RELOBJ) == 0)) {
927 				Gotndx *gnp;
928 
929 				gnp = ld_find_gotndx(&(sdp->sd_GOTndxs),
930 				    GOT_REF_GENERIC, ofl, 0);
931 				assert(gnp);
932 				value = (Xword)gnp->gn_gotndx * M_GOT_ENTSIZE;
933 
934 			} else if ((arsp->rel_flags & FLG_REL_STLS) &&
935 			    ((flags & FLG_OF_RELOBJ) == 0)) {
936 				Xword	tlsstatsize;
937 
938 				/*
939 				 * This is the LE TLS reference model.  Static
940 				 * offset is hard-coded.
941 				 */
942 				tlsstatsize =
943 				    S_ROUND(ofl->ofl_tlsphdr->p_memsz,
944 				    M_TLSSTATALIGN);
945 				value = tlsstatsize - value;
946 
947 				/*
948 				 * Since this code is fixed up, it assumes a
949 				 * negative offset that can be added to the
950 				 * thread pointer.
951 				 */
952 				if ((arsp->rel_rtype == R_386_TLS_LDO_32) ||
953 				    (arsp->rel_rtype == R_386_TLS_LE))
954 					value = -value;
955 			}
956 
957 			if (arsp->rel_isdesc->is_file)
958 				ifl_name = arsp->rel_isdesc->is_file->ifl_name;
959 			else
960 				ifl_name = MSG_INTL(MSG_STR_NULL);
961 
962 			/*
963 			 * Make sure we have data to relocate.  Compiler and
964 			 * assembler developers have been known to generate
965 			 * relocations against invalid sections (normally .bss),
966 			 * so for their benefit give them sufficient information
967 			 * to help analyze the problem.  End users should never
968 			 * see this.
969 			 */
970 			if (arsp->rel_isdesc->is_indata->d_buf == 0) {
971 				Conv_inv_buf_t	inv_buf;
972 
973 				eprintf(ofl->ofl_lml, ERR_FATAL,
974 				    MSG_INTL(MSG_REL_EMPTYSEC),
975 				    conv_reloc_386_type(arsp->rel_rtype,
976 				    0, &inv_buf),
977 				    ifl_name, demangle(arsp->rel_sname),
978 				    arsp->rel_isdesc->is_name);
979 				return (S_ERROR);
980 			}
981 
982 			/*
983 			 * Get the address of the data item we need to modify.
984 			 */
985 			addr = (uchar_t *)((uintptr_t)arsp->rel_roffset +
986 			    (uintptr_t)_elf_getxoff(arsp->rel_isdesc->
987 			    is_indata));
988 
989 			DBG_CALL(Dbg_reloc_doact(ofl->ofl_lml, ELF_DBG_LD,
990 			    M_MACH, SHT_REL, arsp->rel_rtype, EC_NATPTR(addr),
991 			    value, arsp->rel_sname, arsp->rel_osdesc));
992 			addr += (uintptr_t)arsp->rel_osdesc->os_outdata->d_buf;
993 
994 			if ((((uintptr_t)addr - (uintptr_t)ofl->ofl_nehdr) >
995 			    ofl->ofl_size) || (arsp->rel_roffset >
996 			    arsp->rel_osdesc->os_shdr->sh_size)) {
997 				Conv_inv_buf_t	inv_buf;
998 				int		class;
999 
1000 				if (((uintptr_t)addr -
1001 				    (uintptr_t)ofl->ofl_nehdr) > ofl->ofl_size)
1002 					class = ERR_FATAL;
1003 				else
1004 					class = ERR_WARNING;
1005 
1006 				eprintf(ofl->ofl_lml, class,
1007 				    MSG_INTL(MSG_REL_INVALOFFSET),
1008 				    conv_reloc_386_type(arsp->rel_rtype,
1009 				    0, &inv_buf),
1010 				    ifl_name, arsp->rel_isdesc->is_name,
1011 				    demangle(arsp->rel_sname),
1012 				    EC_ADDR((uintptr_t)addr -
1013 				    (uintptr_t)ofl->ofl_nehdr));
1014 
1015 				if (class == ERR_FATAL) {
1016 					return_code = S_ERROR;
1017 					continue;
1018 				}
1019 			}
1020 
1021 			/*
1022 			 * The relocation is additive.  Ignore the previous
1023 			 * symbol value if this local partial symbol is
1024 			 * expanded.
1025 			 */
1026 			if (moved)
1027 				value -= *addr;
1028 
1029 			/*
1030 			 * If we have a replacement value for the relocation
1031 			 * target, put it in place now.
1032 			 */
1033 			if (arsp->rel_flags & FLG_REL_NADDEND) {
1034 				Xword addend = arsp->rel_raddend;
1035 
1036 				if (ld_reloc_targval_set(ofl, arsp,
1037 				    addr, addend) == 0)
1038 					return (S_ERROR);
1039 			}
1040 
1041 			/*
1042 			 * If '-z noreloc' is specified - skip the do_reloc_ld
1043 			 * stage.
1044 			 */
1045 			if (OFL_DO_RELOC(ofl)) {
1046 				if (do_reloc_ld((uchar_t)arsp->rel_rtype, addr,
1047 				    &value, arsp->rel_sname, ifl_name,
1048 				    OFL_SWAP_RELOC_DATA(ofl, arsp),
1049 				    ofl->ofl_lml) == 0)
1050 					return_code = S_ERROR;
1051 			}
1052 		}
1053 	}
1054 	return (return_code);
1055 }
1056 
1057 /*
1058  * Add an output relocation record.
1059  */
1060 static uintptr_t
1061 ld_add_outrel(Word flags, Rel_desc *rsp, Ofl_desc *ofl)
1062 {
1063 	Rel_desc	*orsp;
1064 	Rel_cache	*rcp;
1065 	Sym_desc	*sdp = rsp->rel_sym;
1066 
1067 	/*
1068 	 * Static executables *do not* want any relocations against them.
1069 	 * Since our engine still creates relocations against a WEAK UNDEFINED
1070 	 * symbol in a static executable, it's best to disable them here
1071 	 * instead of through out the relocation code.
1072 	 */
1073 	if ((ofl->ofl_flags & (FLG_OF_STATIC | FLG_OF_EXEC)) ==
1074 	    (FLG_OF_STATIC | FLG_OF_EXEC))
1075 		return (1);
1076 
1077 	/*
1078 	 * If no relocation cache structures are available allocate
1079 	 * a new one and link it into the cache list.
1080 	 */
1081 	if ((ofl->ofl_outrels.tail == 0) ||
1082 	    ((rcp = (Rel_cache *)ofl->ofl_outrels.tail->data) == 0) ||
1083 	    ((orsp = rcp->rc_free) == rcp->rc_end)) {
1084 		static size_t	nextsize = 0;
1085 		size_t		size;
1086 
1087 		/*
1088 		 * Output relocation numbers can vary considerably between
1089 		 * building executables or shared objects (pic vs. non-pic),
1090 		 * etc.  But, they typically aren't very large, so for these
1091 		 * objects use a standard bucket size.  For building relocatable
1092 		 * objects, typically there will be an output relocation for
1093 		 * every input relocation.
1094 		 */
1095 		if (nextsize == 0) {
1096 			if (ofl->ofl_flags & FLG_OF_RELOBJ) {
1097 				if ((size = ofl->ofl_relocincnt) == 0)
1098 					size = REL_LOIDESCNO;
1099 				if (size > REL_HOIDESCNO)
1100 					nextsize = REL_HOIDESCNO;
1101 				else
1102 					nextsize = REL_LOIDESCNO;
1103 			} else
1104 				nextsize = size = REL_HOIDESCNO;
1105 		} else
1106 			size = nextsize;
1107 
1108 		size = size * sizeof (Rel_desc);
1109 
1110 		if (((rcp = libld_malloc(sizeof (Rel_cache) + size)) == 0) ||
1111 		    (list_appendc(&ofl->ofl_outrels, rcp) == 0))
1112 			return (S_ERROR);
1113 
1114 		/* LINTED */
1115 		rcp->rc_free = orsp = (Rel_desc *)(rcp + 1);
1116 		/* LINTED */
1117 		rcp->rc_end = (Rel_desc *)((char *)rcp->rc_free + size);
1118 	}
1119 
1120 	/*
1121 	 * If we are adding a output relocation against a section
1122 	 * symbol (non-RELATIVE) then mark that section.  These sections
1123 	 * will be added to the .dynsym symbol table.
1124 	 */
1125 	if (sdp && (rsp->rel_rtype != M_R_RELATIVE) &&
1126 	    ((flags & FLG_REL_SCNNDX) ||
1127 	    (ELF_ST_TYPE(sdp->sd_sym->st_info) == STT_SECTION))) {
1128 
1129 		/*
1130 		 * If this is a COMMON symbol - no output section
1131 		 * exists yet - (it's created as part of sym_validate()).
1132 		 * So - we mark here that when it's created it should
1133 		 * be tagged with the FLG_OS_OUTREL flag.
1134 		 */
1135 		if ((sdp->sd_flags & FLG_SY_SPECSEC) &&
1136 		    (sdp->sd_sym->st_shndx == SHN_COMMON)) {
1137 			if (ELF_ST_TYPE(sdp->sd_sym->st_info) != STT_TLS)
1138 				ofl->ofl_flags1 |= FLG_OF1_BSSOREL;
1139 			else
1140 				ofl->ofl_flags1 |= FLG_OF1_TLSOREL;
1141 		} else {
1142 			Os_desc	*osp = sdp->sd_isc->is_osdesc;
1143 
1144 			if (osp && ((osp->os_flags & FLG_OS_OUTREL) == 0)) {
1145 				ofl->ofl_dynshdrcnt++;
1146 				osp->os_flags |= FLG_OS_OUTREL;
1147 			}
1148 		}
1149 	}
1150 
1151 	*orsp = *rsp;
1152 	orsp->rel_flags |= flags;
1153 
1154 	rcp->rc_free++;
1155 	ofl->ofl_outrelscnt++;
1156 
1157 	if (flags & FLG_REL_GOT)
1158 		ofl->ofl_relocgotsz += (Xword)sizeof (Rel);
1159 	else if (flags & FLG_REL_PLT)
1160 		ofl->ofl_relocpltsz += (Xword)sizeof (Rel);
1161 	else if (flags & FLG_REL_BSS)
1162 		ofl->ofl_relocbsssz += (Xword)sizeof (Rel);
1163 	else if (flags & FLG_REL_NOINFO)
1164 		ofl->ofl_relocrelsz += (Xword)sizeof (Rel);
1165 	else
1166 		orsp->rel_osdesc->os_szoutrels += (Xword)sizeof (Rel);
1167 
1168 	if (orsp->rel_rtype == M_R_RELATIVE)
1169 		ofl->ofl_relocrelcnt++;
1170 
1171 	/*
1172 	 * We don't perform sorting on PLT relocations because
1173 	 * they have already been assigned a PLT index and if we
1174 	 * were to sort them we would have to re-assign the plt indexes.
1175 	 */
1176 	if (!(flags & FLG_REL_PLT))
1177 		ofl->ofl_reloccnt++;
1178 
1179 	/*
1180 	 * Insure a GLOBAL_OFFSET_TABLE is generated if required.
1181 	 */
1182 	if (IS_GOT_REQUIRED(orsp->rel_rtype))
1183 		ofl->ofl_flags |= FLG_OF_BLDGOT;
1184 
1185 	/*
1186 	 * Identify and possibly warn of a displacement relocation.
1187 	 */
1188 	if (orsp->rel_flags & FLG_REL_DISP) {
1189 		ofl->ofl_dtflags_1 |= DF_1_DISPRELPND;
1190 
1191 		if (ofl->ofl_flags & FLG_OF_VERBOSE)
1192 			ld_disp_errmsg(MSG_INTL(MSG_REL_DISPREL4), orsp, ofl);
1193 	}
1194 	DBG_CALL(Dbg_reloc_ors_entry(ofl->ofl_lml, ELF_DBG_LD, SHT_REL,
1195 	    M_MACH, orsp));
1196 	return (1);
1197 }
1198 
1199 /*
1200  * process relocation for a LOCAL symbol
1201  */
1202 static uintptr_t
1203 ld_reloc_local(Rel_desc * rsp, Ofl_desc * ofl)
1204 {
1205 	ofl_flag_t	flags = ofl->ofl_flags;
1206 	Sym_desc	*sdp = rsp->rel_sym;
1207 	Word		shndx = sdp->sd_sym->st_shndx;
1208 
1209 	/*
1210 	 * if ((shared object) and (not pc relative relocation) and
1211 	 *    (not against ABS symbol))
1212 	 * then
1213 	 *	build R_386_RELATIVE
1214 	 * fi
1215 	 */
1216 	if ((flags & FLG_OF_SHAROBJ) && (rsp->rel_flags & FLG_REL_LOAD) &&
1217 	    !(IS_PC_RELATIVE(rsp->rel_rtype)) && !(IS_SIZE(rsp->rel_rtype)) &&
1218 	    !(IS_GOT_BASED(rsp->rel_rtype)) &&
1219 	    !(rsp->rel_isdesc != NULL &&
1220 	    (rsp->rel_isdesc->is_shdr->sh_type == SHT_SUNW_dof)) &&
1221 	    (((sdp->sd_flags & FLG_SY_SPECSEC) == 0) ||
1222 	    (shndx != SHN_ABS) || (sdp->sd_aux && sdp->sd_aux->sa_symspec))) {
1223 		Word	ortype = rsp->rel_rtype;
1224 
1225 		rsp->rel_rtype = R_386_RELATIVE;
1226 		if (ld_add_outrel(NULL, rsp, ofl) == S_ERROR)
1227 			return (S_ERROR);
1228 		rsp->rel_rtype = ortype;
1229 	}
1230 
1231 	/*
1232 	 * If the relocation is against a 'non-allocatable' section
1233 	 * and we can not resolve it now - then give a warning
1234 	 * message.
1235 	 *
1236 	 * We can not resolve the symbol if either:
1237 	 *	a) it's undefined
1238 	 *	b) it's defined in a shared library and a
1239 	 *	   COPY relocation hasn't moved it to the executable
1240 	 *
1241 	 * Note: because we process all of the relocations against the
1242 	 *	text segment before any others - we know whether
1243 	 *	or not a copy relocation will be generated before
1244 	 *	we get here (see reloc_init()->reloc_segments()).
1245 	 */
1246 	if (!(rsp->rel_flags & FLG_REL_LOAD) &&
1247 	    ((shndx == SHN_UNDEF) ||
1248 	    ((sdp->sd_ref == REF_DYN_NEED) &&
1249 	    ((sdp->sd_flags & FLG_SY_MVTOCOMM) == 0)))) {
1250 		Conv_inv_buf_t inv_buf;
1251 
1252 		/*
1253 		 * If the relocation is against a SHT_SUNW_ANNOTATE
1254 		 * section - then silently ignore that the relocation
1255 		 * can not be resolved.
1256 		 */
1257 		if (rsp->rel_osdesc &&
1258 		    (rsp->rel_osdesc->os_shdr->sh_type == SHT_SUNW_ANNOTATE))
1259 			return (0);
1260 		eprintf(ofl->ofl_lml, ERR_WARNING, MSG_INTL(MSG_REL_EXTERNSYM),
1261 		    conv_reloc_386_type(rsp->rel_rtype, 0, &inv_buf),
1262 		    rsp->rel_isdesc->is_file->ifl_name,
1263 		    demangle(rsp->rel_sname), rsp->rel_osdesc->os_name);
1264 		return (1);
1265 	}
1266 
1267 	/*
1268 	 * Perform relocation.
1269 	 */
1270 	return (ld_add_actrel(NULL, rsp, ofl));
1271 }
1272 
1273 static uintptr_t
1274 ld_reloc_TLS(Boolean local, Rel_desc * rsp, Ofl_desc * ofl)
1275 {
1276 	Word		rtype = rsp->rel_rtype;
1277 	Sym_desc	*sdp = rsp->rel_sym;
1278 	ofl_flag_t	flags = ofl->ofl_flags;
1279 	Gotndx		*gnp;
1280 
1281 	/*
1282 	 * If we're building an executable - use either the IE or LE access
1283 	 * model.  If we're building a shared object process any IE model.
1284 	 */
1285 	if ((flags & FLG_OF_EXEC) || (IS_TLS_IE(rtype))) {
1286 		/*
1287 		 * Set the DF_STATIC_TLS flag.
1288 		 */
1289 		ofl->ofl_dtflags |= DF_STATIC_TLS;
1290 
1291 		if (!local || ((flags & FLG_OF_EXEC) == 0)) {
1292 			/*
1293 			 * Assign a GOT entry for static TLS references.
1294 			 */
1295 			if ((gnp = ld_find_gotndx(&(sdp->sd_GOTndxs),
1296 			    GOT_REF_TLSIE, ofl, 0)) == 0) {
1297 
1298 				if (ld_assign_got_TLS(local, rsp, ofl, sdp,
1299 				    gnp, GOT_REF_TLSIE, FLG_REL_STLS,
1300 				    rtype, R_386_TLS_TPOFF, 0) == S_ERROR)
1301 					return (S_ERROR);
1302 			}
1303 
1304 			/*
1305 			 * IE access model.
1306 			 */
1307 			if (IS_TLS_IE(rtype)) {
1308 				if (ld_add_actrel(FLG_REL_STLS,
1309 				    rsp, ofl) == S_ERROR)
1310 					return (S_ERROR);
1311 
1312 				/*
1313 				 * A non-pic shared object needs to adjust the
1314 				 * active relocation (indntpoff).
1315 				 */
1316 				if (((flags & FLG_OF_EXEC) == 0) &&
1317 				    (rtype == R_386_TLS_IE)) {
1318 					rsp->rel_rtype = R_386_RELATIVE;
1319 					return (ld_add_outrel(NULL, rsp, ofl));
1320 				}
1321 				return (1);
1322 			}
1323 
1324 			/*
1325 			 * Fixups are required for other executable models.
1326 			 */
1327 			return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS),
1328 			    rsp, ofl));
1329 		}
1330 
1331 		/*
1332 		 * LE access model.
1333 		 */
1334 		if (IS_TLS_LE(rtype) || (rtype == R_386_TLS_LDO_32))
1335 			return (ld_add_actrel(FLG_REL_STLS, rsp, ofl));
1336 
1337 		return (ld_add_actrel((FLG_REL_TLSFIX | FLG_REL_STLS),
1338 		    rsp, ofl));
1339 	}
1340 
1341 	/*
1342 	 * Building a shared object.
1343 	 *
1344 	 * Assign a GOT entry for a dynamic TLS reference.
1345 	 */
1346 	if (IS_TLS_LD(rtype) && ((gnp = ld_find_gotndx(&(sdp->sd_GOTndxs),
1347 	    GOT_REF_TLSLD, ofl, 0)) == 0)) {
1348 
1349 		if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSLD,
1350 		    FLG_REL_MTLS, rtype, R_386_TLS_DTPMOD32, 0) == S_ERROR)
1351 			return (S_ERROR);
1352 
1353 	} else if (IS_TLS_GD(rtype) &&
1354 	    ((gnp = ld_find_gotndx(&(sdp->sd_GOTndxs), GOT_REF_TLSGD,
1355 	    ofl, 0)) == 0)) {
1356 
1357 		if (ld_assign_got_TLS(local, rsp, ofl, sdp, gnp, GOT_REF_TLSGD,
1358 		    FLG_REL_DTLS, rtype, R_386_TLS_DTPMOD32,
1359 		    R_386_TLS_DTPOFF32) == S_ERROR)
1360 			return (S_ERROR);
1361 	}
1362 
1363 	/*
1364 	 * For GD/LD TLS reference - TLS_{GD,LD}_CALL, this will eventually
1365 	 * cause a call to __tls_get_addr().  Convert this relocation to that
1366 	 * symbol now, and prepare for the PLT magic.
1367 	 */
1368 	if ((rtype == R_386_TLS_GD_PLT) || (rtype == R_386_TLS_LDM_PLT)) {
1369 		Sym_desc	*tlsgetsym;
1370 
1371 		if ((tlsgetsym = ld_sym_add_u(MSG_ORIG(MSG_SYM_TLSGETADDR_UU),
1372 		    ofl, MSG_STR_TLSREL)) == (Sym_desc *)S_ERROR)
1373 			return (S_ERROR);
1374 
1375 		rsp->rel_sym = tlsgetsym;
1376 		rsp->rel_sname = tlsgetsym->sd_name;
1377 		rsp->rel_rtype = R_386_PLT32;
1378 
1379 		if (ld_reloc_plt(rsp, ofl) == S_ERROR)
1380 			return (S_ERROR);
1381 
1382 		rsp->rel_sym = sdp;
1383 		rsp->rel_sname = sdp->sd_name;
1384 		rsp->rel_rtype = rtype;
1385 		return (1);
1386 	}
1387 
1388 	if (IS_TLS_LD(rtype))
1389 		return (ld_add_actrel(FLG_REL_MTLS, rsp, ofl));
1390 
1391 	return (ld_add_actrel(FLG_REL_DTLS, rsp, ofl));
1392 }
1393 
1394 /* ARGSUSED3 */
1395 static Gotndx *
1396 ld_find_gotndx(List * lst, Gotref gref, Ofl_desc * ofl, Rel_desc * rdesc)
1397 {
1398 	Listnode *	lnp;
1399 	Gotndx *	gnp;
1400 
1401 	if ((gref == GOT_REF_TLSLD) && ofl->ofl_tlsldgotndx)
1402 		return (ofl->ofl_tlsldgotndx);
1403 
1404 	for (LIST_TRAVERSE(lst, lnp, gnp)) {
1405 		if (gnp->gn_gotref == gref)
1406 			return (gnp);
1407 	}
1408 	return ((Gotndx *)0);
1409 }
1410 
1411 static Xword
1412 ld_calc_got_offset(Rel_desc * rdesc, Ofl_desc * ofl)
1413 {
1414 	Os_desc		*osp = ofl->ofl_osgot;
1415 	Sym_desc	*sdp = rdesc->rel_sym;
1416 	Xword		gotndx;
1417 	Gotref		gref;
1418 	Gotndx		*gnp;
1419 
1420 	if (rdesc->rel_flags & FLG_REL_DTLS)
1421 		gref = GOT_REF_TLSGD;
1422 	else if (rdesc->rel_flags & FLG_REL_MTLS)
1423 		gref = GOT_REF_TLSLD;
1424 	else if (rdesc->rel_flags & FLG_REL_STLS)
1425 		gref = GOT_REF_TLSIE;
1426 	else
1427 		gref = GOT_REF_GENERIC;
1428 
1429 	gnp = ld_find_gotndx(&(sdp->sd_GOTndxs), gref, ofl, 0);
1430 	assert(gnp);
1431 
1432 	gotndx = (Xword)gnp->gn_gotndx;
1433 
1434 	if ((rdesc->rel_flags & FLG_REL_DTLS) &&
1435 	    (rdesc->rel_rtype == R_386_TLS_DTPOFF32))
1436 		gotndx++;
1437 
1438 	return ((Xword)(osp->os_shdr->sh_addr + (gotndx * M_GOT_ENTSIZE)));
1439 }
1440 
1441 
1442 /* ARGSUSED4 */
1443 static uintptr_t
1444 ld_assign_got_ndx(List * lst, Gotndx * pgnp, Gotref gref, Ofl_desc * ofl,
1445     Rel_desc * rsp, Sym_desc * sdp)
1446 {
1447 	Gotndx	*gnp;
1448 	uint_t	gotents;
1449 
1450 	if (pgnp)
1451 		return (1);
1452 
1453 	if ((gref == GOT_REF_TLSGD) || (gref == GOT_REF_TLSLD))
1454 		gotents = 2;
1455 	else
1456 		gotents = 1;
1457 
1458 	if ((gnp = libld_calloc(sizeof (Gotndx), 1)) == 0)
1459 		return (S_ERROR);
1460 	gnp->gn_gotndx = ofl->ofl_gotcnt;
1461 	gnp->gn_gotref = gref;
1462 
1463 	ofl->ofl_gotcnt += gotents;
1464 
1465 	if (gref == GOT_REF_TLSLD) {
1466 		ofl->ofl_tlsldgotndx = gnp;
1467 		return (1);
1468 	}
1469 
1470 	if (list_appendc(lst, (void *)gnp) == 0)
1471 		return (S_ERROR);
1472 
1473 	return (1);
1474 }
1475 
1476 static void
1477 ld_assign_plt_ndx(Sym_desc * sdp, Ofl_desc *ofl)
1478 {
1479 	sdp->sd_aux->sa_PLTndx = 1 + ofl->ofl_pltcnt++;
1480 	sdp->sd_aux->sa_PLTGOTndx = ofl->ofl_gotcnt++;
1481 	ofl->ofl_flags |= FLG_OF_BLDGOT;
1482 }
1483 
1484 /*
1485  * Initializes .got[0] with the _DYNAMIC symbol value.
1486  */
1487 static uintptr_t
1488 ld_fillin_gotplt(Ofl_desc *ofl)
1489 {
1490 	ofl_flag_t	flags = ofl->ofl_flags;
1491 	int		bswap = (ofl->ofl_flags1 & FLG_OF1_ENCDIFF) != 0;
1492 
1493 	if (ofl->ofl_osgot) {
1494 		Sym_desc	*sdp;
1495 
1496 		if ((sdp = ld_sym_find(MSG_ORIG(MSG_SYM_DYNAMIC_U),
1497 		    SYM_NOHASH, 0, ofl)) != NULL) {
1498 			uchar_t	*genptr;
1499 
1500 			genptr = ((uchar_t *)ofl->ofl_osgot->os_outdata->d_buf +
1501 			    (M_GOT_XDYNAMIC * M_GOT_ENTSIZE));
1502 			/* LINTED */
1503 			*(Word *)genptr = (Word)sdp->sd_sym->st_value;
1504 			if (bswap)
1505 				/* LINTED */
1506 				*(Word *)genptr =
1507 				    /* LINTED */
1508 				    ld_bswap_Word(*(Word *)genptr);
1509 		}
1510 	}
1511 
1512 	/*
1513 	 * Fill in the reserved slot in the procedure linkage table the first
1514 	 * entry is:
1515 	 *  if (building a.out) {
1516 	 *	PUSHL	got[1]		    # the address of the link map entry
1517 	 *	JMP *	got[2]		    # the address of rtbinder
1518 	 *  } else {
1519 	 *	PUSHL	got[1]@GOT(%ebx)    # the address of the link map entry
1520 	 *	JMP *	got[2]@GOT(%ebx)    # the address of rtbinder
1521 	 *  }
1522 	 */
1523 	if ((flags & FLG_OF_DYNAMIC) && ofl->ofl_osplt) {
1524 		uchar_t *pltent;
1525 
1526 		pltent = (uchar_t *)ofl->ofl_osplt->os_outdata->d_buf;
1527 		if (!(flags & FLG_OF_SHAROBJ)) {
1528 			pltent[0] = M_SPECIAL_INST;
1529 			pltent[1] = M_PUSHL_DISP;
1530 			pltent += 2;
1531 			/* LINTED */
1532 			*(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->
1533 			    sh_addr + M_GOT_XLINKMAP * M_GOT_ENTSIZE);
1534 			if (bswap)
1535 				/* LINTED */
1536 				*(Word *)pltent =
1537 				    /* LINTED */
1538 				    ld_bswap_Word(*(Word *)pltent);
1539 			pltent += 4;
1540 			pltent[0] = M_SPECIAL_INST;
1541 			pltent[1] = M_JMP_DISP_IND;
1542 			pltent += 2;
1543 			/* LINTED */
1544 			*(Word *)pltent = (Word)(ofl->ofl_osgot->os_shdr->
1545 			    sh_addr + M_GOT_XRTLD * M_GOT_ENTSIZE);
1546 			if (bswap)
1547 				/* LINTED */
1548 				*(Word *)pltent =
1549 				    /* LINTED */
1550 				    ld_bswap_Word(*(Word *)pltent);
1551 		} else {
1552 			pltent[0] = M_SPECIAL_INST;
1553 			pltent[1] = M_PUSHL_REG_DISP;
1554 			pltent += 2;
1555 			/* LINTED */
1556 			*(Word *)pltent = (Word)(M_GOT_XLINKMAP *
1557 			    M_GOT_ENTSIZE);
1558 			if (bswap)
1559 				/* LINTED */
1560 				*(Word *)pltent =
1561 				    /* LINTED */
1562 				    ld_bswap_Word(*(Word *)pltent);
1563 			pltent += 4;
1564 			pltent[0] = M_SPECIAL_INST;
1565 			pltent[1] = M_JMP_REG_DISP_IND;
1566 			pltent += 2;
1567 			/* LINTED */
1568 			*(Word *)pltent = (Word)(M_GOT_XRTLD *
1569 			    M_GOT_ENTSIZE);
1570 			if (bswap)
1571 				/* LINTED */
1572 				*(Word *)pltent =
1573 				    /* LINTED */
1574 				    ld_bswap_Word(*(Word *)pltent);
1575 		}
1576 	}
1577 	return (1);
1578 }
1579 
1580 
1581 
1582 /*
1583  * Template for generating "void (*)(void)" function
1584  */
1585 static const uchar_t nullfunc_tmpl[] = {	/* IA32 */
1586 /* 0x00 */	0xc3				/* ret */
1587 };
1588 
1589 
1590 
1591 /*
1592  * Return the ld_targ definition for this target.
1593  */
1594 const Target *
1595 ld_targ_init_x86(void)
1596 {
1597 	static const Target _ld_targ = {
1598 		{			/* Target_mach */
1599 			M_MACH,			/* m_mach */
1600 			M_MACHPLUS,		/* m_machplus */
1601 			M_FLAGSPLUS,		/* m_flagsplus */
1602 			M_CLASS,		/* m_class */
1603 			M_DATA,			/* m_data */
1604 
1605 			M_SEGM_ALIGN,		/* m_segm_align */
1606 			M_SEGM_ORIGIN,		/* m_segm_origin */
1607 			M_DATASEG_PERM,		/* m_dataseg_perm */
1608 			M_WORD_ALIGN,		/* m_word_align */
1609 			MSG_ORIG(MSG_PTH_RTLD),	/* m_def_interp */
1610 
1611 			/* Relocation type codes */
1612 			M_R_ARRAYADDR,		/* m_r_arrayaddr */
1613 			M_R_COPY,		/* m_r_copy */
1614 			M_R_GLOB_DAT,		/* m_r_glob_dat */
1615 			M_R_JMP_SLOT,		/* m_r_jmp_slot */
1616 			M_R_NUM,		/* m_r_num */
1617 			M_R_NONE,		/* m_r_none */
1618 			M_R_RELATIVE,		/* m_r_relative */
1619 			M_R_REGISTER,		/* m_r_register */
1620 
1621 			/* Relocation related constants */
1622 			M_REL_DT_COUNT,		/* m_rel_dt_count */
1623 			M_REL_DT_ENT,		/* m_rel_dt_ent */
1624 			M_REL_DT_SIZE,		/* m_rel_dt_size */
1625 			M_REL_DT_TYPE,		/* m_rel_dt_type */
1626 			M_REL_SHT_TYPE,		/* m_rel_sht_type */
1627 
1628 			/* GOT related constants */
1629 			M_GOT_ENTSIZE,		/* m_got_entsize */
1630 			M_GOT_XNumber,		/* m_got_xnumber */
1631 
1632 			/* PLT related constants */
1633 			M_PLT_ALIGN,		/* m_plt_align */
1634 			M_PLT_ENTSIZE,		/* m_plt_entsize */
1635 			M_PLT_RESERVSZ,		/* m_plt_reservsz */
1636 			M_PLT_SHF_FLAGS,	/* m_plt_shf_flags */
1637 
1638 			M_DT_REGISTER,		/* m_dt_register */
1639 		},
1640 		{			/* Target_machid */
1641 			M_ID_ARRAY,		/* id_array */
1642 			M_ID_BSS,		/* id_bss */
1643 			M_ID_CAP,		/* id_cap */
1644 			M_ID_DATA,		/* id_data */
1645 			M_ID_DYNAMIC,		/* id_dynamic */
1646 			M_ID_DYNSORT,		/* id_dynsort */
1647 			M_ID_DYNSTR,		/* id_dynstr */
1648 			M_ID_DYNSYM,		/* id_dynsym */
1649 			M_ID_DYNSYM_NDX,	/* id_dynsym_ndx */
1650 			M_ID_GOT,		/* id_got */
1651 			M_ID_UNKNOWN,		/* id_gotdata (unused) */
1652 			M_ID_HASH,		/* id_hash */
1653 			M_ID_INTERP,		/* id_interp */
1654 			M_ID_LBSS,		/* id_lbss */
1655 			M_ID_LDYNSYM,		/* id_ldynsym */
1656 			M_ID_NOTE,		/* id_note */
1657 			M_ID_NULL,		/* id_null */
1658 			M_ID_PLT,		/* id_plt */
1659 			M_ID_REL,		/* id_rel */
1660 			M_ID_STRTAB,		/* id_strtab */
1661 			M_ID_SYMINFO,		/* id_syminfo */
1662 			M_ID_SYMTAB,		/* id_symtab */
1663 			M_ID_SYMTAB_NDX,	/* id_symtab_ndx */
1664 			M_ID_TEXT,		/* id_text */
1665 			M_ID_TLS,		/* id_tls */
1666 			M_ID_TLSBSS,		/* id_tlsbss */
1667 			M_ID_UNKNOWN,		/* id_unknown */
1668 			M_ID_UNWIND,		/* id_unwind */
1669 			M_ID_USER,		/* id_user */
1670 			M_ID_VERSION,		/* id_version */
1671 		},
1672 		{			/* Target_nullfunc */
1673 			nullfunc_tmpl,		/* nf_template */
1674 			sizeof (nullfunc_tmpl),	/* nf_size */
1675 		},
1676 		{			/* Target_machrel */
1677 			reloc_table,
1678 
1679 			ld_init_rel,		/* mr_init_rel */
1680 			ld_mach_eflags,		/* mr_mach_eflags */
1681 			ld_mach_make_dynamic,	/* mr_mach_make_dynamic */
1682 			ld_mach_update_odynamic, /* mr_mach_update_odynamic */
1683 			ld_calc_plt_addr,	/* mr_calc_plt_addr */
1684 			ld_perform_outreloc,	/* mr_perform_outreloc */
1685 			ld_do_activerelocs,	/* mr_do_activerelocs */
1686 			ld_add_outrel,		/* mr_add_outrel */
1687 			NULL,			/* mr_reloc_register */
1688 			ld_reloc_local,		/* mr_reloc_local */
1689 			NULL,			/* mr_reloc_GOTOP */
1690 			ld_reloc_TLS,		/* mr_reloc_TLS */
1691 			NULL,			/* mr_assign_got */
1692 			ld_find_gotndx,		/* mr_find_gotndx */
1693 			ld_calc_got_offset,	/* mr_calc_got_offset */
1694 			ld_assign_got_ndx,	/* mr_assign_got_ndx */
1695 			ld_assign_plt_ndx,	/* mr_assign_plt_ndx */
1696 			NULL,			/* mr_allocate_got */
1697 			ld_fillin_gotplt,	/* mr_fillin_gotplt */
1698 		},
1699 		{			/* Target_machsym */
1700 			NULL,			/* ms_reg_check */
1701 			NULL,			/* ms_mach_sym_typecheck */
1702 			NULL,			/* ms_is_regsym */
1703 			NULL,			/* ms_reg_find */
1704 			NULL			/* ms_reg_enter */
1705 		},
1706 		{			/* Target_unwind */
1707 			NULL,		/* uw_make_unwindhdr */
1708 			NULL,		/* uw_populate_unwindhdr */
1709 			NULL,		/* uw_append_unwind */
1710 		}
1711 	};
1712 
1713 	return (&_ld_targ);
1714 }
1715